FID Dual 1 GbE Compact Appliance
A palm-sized two-interface appliance for portable labs, field kits, and space-constrained inline deployments. Effective throughput depends on enabled FID functions, traffic characteristics, and configuration.
FID
Turn a Live Network Link Into a Programmable Test Surface
FID sits transparently between real endpoints so you can observe, filter, manipulate, and inject traffic without readdressing the endpoints.
Programmable inline platformDual 1 GbE or 10 GbE appliancesConnected or air-gappedAPI + RIGS extensibility
An Extensible Platform, Not a Fixed Test Catalog
FID is an extensible network experimentation platform for engineers who need to work with traffic in flight. It sits inline, learns the endpoints and conversations already present on the link, and maintains that context as traffic is observed, selectively diverted to a tool, or reinjected. That lets operator tooling participate in a live network without readdressing the endpoints or treating every packet as an isolated event. FID provides traffic-handling primitives, automation APIs, and extension points for standard and proprietary protocols while leaving protocol-specific test logic in operator tools and RIGS.
FID handles the traffic plumbing that makes inline tooling useful on a live network: it keeps the two directions of a selected conversation associated, lets unrelated replies continue inline, and uses learned network context when operator traffic returns to the wire. Protocol-specific test logic stays in packaged tools or reusable operator-developed RIGS.
Put your tools in the conversation.
FID handles the traffic paths. Your tools supply the protocol logic.
Illustrated IPv4 example: FID diverts one selected message from Endpoint A to a custom forwarding RIG, without sending an unchanged copy to B. The RIG’s illustrative protocol rule changes the payload from 20 to 25 and forwards it to Endpoint B. In this example, B echoes 25 in its reply. The reply pauses at the RIG, whose custom rule changes 25 back to 20 before forwarding it to A. Both directions use matching illustrative travel times and a pause at the tool, not measured processing latencies. Unselected messages cross FID unchanged. The RIG supplies protocol parsing, modification, forwarding and reverse handling; filtering alone does not forward the original message.
Standard Capabilities Included
✓
Traffic Observation & Flow Learning
Observe live traffic and learn endpoint identity, direction, and conversation context before deciding what to intercept. Passive DNS and TLS Server Name Indication (SNI) observations add application-level clues without first diverting the traffic.
✓
Stateful TCP / UDP Filtering
Select traffic by protocol and flow criteria while keeping the two directions of a conversation associated. Selected sessions can stay bound to an operator tool while unrelated return traffic continues to its intended endpoint.
✓
Traffic Injection & Reinjection
Introduce operator-generated traffic into the live path using learned network context, then steer replies or tool-processed traffic back to the correct side without exposing the tool's private network identity on the target link.
✓
Operator Tool Containers
Operator tools run in Docker containers attached to selected traffic. Inside the container, operators can use standard Linux networking interfaces, sockets, raw sockets, packet tools, and applications while FID handles the inline Layer 2 plumbing. The supported tool catalog includes shell access, mitmproxy, testssl.sh, and other packaged analysis utilities.
✓
Packet Capture & Inspection
Capture selected traffic for offline analysis while retaining the live inline network context.
✓
Extensible RIGS Framework
RIGS are operator-developed, reusable test modules and workflows built on FID's traffic access and automation interfaces.
How FID Fits Into a Test Workflow
1
Insert FID Inline
Place FID between two network endpoints or network segments. Existing endpoint addressing remains unchanged.
2
Learn and Observe
Learn who is on each side of the link and how live conversations are flowing, while observing DNS activity and TLS SNI indications.
3
Filter or Divert Traffic
Select TCP or UDP conversations of interest and steer them to an operator tool while FID keeps their forward and return traffic associated.
4
Attach a Tool or RIG
Use a packaged Docker operator tool or an operator-developed RIG. RIGS can be built from customer-furnished protocol specifications, including Interface Control Documents (ICDs), observed traffic, operator knowledge, and user-defined test objectives.
5
Inject or Reinject
Generate new test traffic or return tool-processed traffic to the live path using learned network context so it reaches the correct side and its replies return coherently.
Extension framework
RIGS: Operator-Developed Test Modules and Workflows
FID provides the platform and APIs for traffic access. RIGS are reusable test modules or coordinated test workflows built on that platform by operators or integrators. They can use customer-furnished protocol specifications, including Interface Control Documents (ICDs), observed traffic, and operator knowledge, but FID does not automatically interpret those specifications or invent protocol semantics. Test logic and evaluation criteria remain user-defined.
- ✓Encode message formats and protocol behavior from a customer-furnished protocol specification or ICD
- ✓Generate or modify test traffic according to user-defined test logic
- ✓Apply user-defined evaluation criteria to repeatable procedures
- ✓Coordinate existing tools such as scanners, packet analyzers, or custom Python utilities
Network trafficReal endpoint conversation
→FID platformSelect + steer traffic
→RIG / ToolProtocol-aware logic
→Back in pathObserve / alter / inject
Where the Work Happens
L2
Preserve or manipulate Ethernet identities and frame-level behavior.
L3
Operate inline without requiring endpoint readdressing; control IP-level forwarding and translation.
L4
Select and steer flows by transport context while maintaining stateful handling.
L5–7
Attach protocol-aware tools and operator-developed RIGS for application and proprietary-message semantics.
Deployment Options
FID Dual 10 GbE Appliance
A dedicated two-interface appliance for higher-rate inline analysis and experimentation. Effective throughput depends on enabled FID functions, traffic characteristics, and configuration. For customers with TAA requirements, Bowline can quote a hardware configuration whose TAA status and country of origin are documented with the quotation.
FID + EtherShunt
Pair FID with EtherShunt when you need remote insertion/removal plus hardware fail-safe bypass. EtherShunt-integrated operation is limited to 1 Gb.
Why Inline Matters
Test as the network actually exists
FID works in path with the real endpoints, routes, MAC addresses, and IP addresses rather than reproducing the environment in an isolated lab.
Evaluate controls in the real network context
Authorized inline testing can preserve endpoint-facing identities and the existing topology, allowing permitted workflows to be exercised in the same context seen by basic MAC/IP allowlists and other network controls.
Use the platform today, extend it tomorrow
Standard capabilities and packaged tools are available immediately, while operators or integrators can add proprietary protocol knowledge as reusable RIGS and automation.
24-month platform license
Works Fully Connected or Air-Gapped
FID does not require cloud reach-back for normal operation and can run fully in connected, disconnected, or air-gapped environments. The 24-month platform license includes a quarterly offline maintenance checkpoint. When applicable updates are available, Bowline provides an offline maintenance package; when no update is needed, the checkpoint may consist of a status notice. Maintenance may include FID fixes plus applicable security, stability, and compatibility updates for the software baseline delivered and supported by Bowline after validation with FID. Confirmed defects may also be addressed with out-of-cycle fixes when appropriate.
Standard Defect Support
During an active license term, customers can report FID defects to Bowline. Confirmed defects may be addressed in a scheduled or out-of-cycle maintenance release. Standard support does not include a guaranteed response-time SLA.
License renewal: FID licensed software functionality requires a current license and becomes unavailable after expiration until the license is renewed.
24-month appliance-bound licenseContact for quote24 months / applianceFID Offerings
Platform Specifications
✓Transparent inline traffic observation, filtering, manipulation, and injection
✓Layer 2–4 traffic handling with higher-layer workflows supplied by tools, scripts, and operator-developed RIGS
✓Passive DNS and TLS SNI observations plus learned endpoint and flow context
✓Docker-based operator-tool containers that expose selected traffic through standard Linux networking interfaces, including shell, mitmproxy, and testssl.sh
✓Automation API and agent-friendly control interfaces
✓Extension framework for customer-developed protocol and test workflows
✓Appliance-bound licensing suitable for disconnected and air-gapped deployments
✓Quarterly offline maintenance checkpoints included with the 24-month platform license
✓Dual 1 GbE compact and dual 10 GbE appliance configurations available; effective throughput depends on enabled FID functions, traffic characteristics, and configuration
Talk Through Your Network or ICD
FID is most useful when it is shaped around the system you actually need to exercise. Tell us what sits on the wire, what you need to observe or change, and whether the environment is connected or air-gapped.
Prefer email? Reach us directly at contact@bowlineeng.com.